> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zerodash.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# IP allowlist

> Which addresses to trust on your side, and how to restrict who can reach the Customer API on ours.

The allowlist works in both directions, but it is **mandatory in one of them**.

<Columns cols={2}>
  <Card title="Your wallet callbacks" icon="shield-halved" horizontal>
    **Required.** Accept requests only from the Zero-Dash addresses below.
  </Card>

  <Card title="The Customer API" icon="filter" horizontal>
    **Optional.** Give us your egress addresses and we will refuse everything else.
  </Card>
</Columns>

## Zero-Dash source addresses

All wallet callbacks originate from these addresses:

| IP address       |      |
| ---------------- | ---- |
| `104.248.19.126` | IPv4 |
| `46.101.149.79`  | IPv4 |

<Warning>
  You must accept wallet callback requests **only** from these addresses. Zero-Dash takes no responsibility for malicious requests reaching your endpoints from any other source address.
</Warning>

Enforce this at the edge — firewall, load balancer or WAF — so unauthenticated traffic never reaches your application. Signature verification stays in place as the second layer: the allowlist answers *who connected*, the signature answers *who wrote this message*.

<CodeGroup>
  ```nginx nginx theme={null}
  location /zerodash/ {
      allow 104.248.19.126;
      allow 46.101.149.79;
      deny  all;

      proxy_pass http://wallet_upstream;
  }
  ```

  ```yaml Cloud firewall theme={null}
  - name: allow-zerodash-callbacks
    direction: ingress
    protocol: tcp
    ports: [443]
    source_ranges:
      - 104.248.19.126/32
      - 46.101.149.79/32
  ```

  ```
  # Anything else reaching /zerodash/* is dropped before it hits your wallet.
  ```
</CodeGroup>

<Tip>
  Terminating TLS at a CDN or load balancer? Then the source IP your application sees is the proxy's. Enforce the allowlist at the proxy itself, or trust `X-Forwarded-For` **only** from that proxy — never from the open internet.
</Tip>

## Restricting the Customer API

Optional, and recommended. Send us the public egress addresses your servers call from and we will reject requests arriving from anywhere else, even correctly signed ones.

<Steps>
  <Step title="Collect your egress addresses" icon="list">
    Every environment that will call the API: production, staging, and any NAT gateway they exit through. A stolen secret key becomes far less useful when it only works from two addresses.
  </Step>

  <Step title="Send them during onboarding" icon="envelope">
    Include the environment each address belongs to. Getting this wrong locks your own integration out, so double-check before you send.
  </Step>

  <Step title="Tell us before you change them" icon="bell">
    Migrating regions, adding a NAT gateway or scaling out to new addresses? Send the update ahead of the change, not after.
  </Step>
</Steps>

<Note>
  Leave the Customer API allowlist unset and any source address is accepted, provided the signature and timestamp are valid.
</Note>